Read the docs
TI-2022-00288 Aliases CVE-2022-0363GHSA-jm4r-xvc8-8q43

myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation

Priority LOW 20CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.

Why it matters now

EPSS 0.00344 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed myCred (Unknown): 2.4.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownmyCredbefore 2.4.3.12.4.3.1Patch availableCNA
  • myCred VendorUnknown Affected before 2.4.3.1 Fixed in 2.4.3.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpexperts:mycred:*:*:*:*:*:wordpress:*:*before 2.4.3.1VulnerableWPExperts
  • cpe:2.3:a:wpexperts:mycred:*:*:*:*:*:wordpress:*:* Versions before 2.4.3.1 Vulnerable ·WPExperts

Remediation

  • Fix · CNA myCred (Unknown) Fixed in 2.4.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    myCred 2.4.3.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-00987 myCred < 2.4.4 - Subscriber+ Import/Export to Email Address DisclosurePriority LOW 20
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0363
  2. 2026-10-03 Alias added: GHSA-jm4r-xvc8-8q43

References

Exploit 1

  • TI-2021-07037 myCred < 2.3 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.8
  • TI-2023-17566 WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2024-28867 WordPress myCred plugin <= 2.7.2 - Sensitive Data Exposure vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2023-25961 WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
  • TI-2022-00219 Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2022-00987 myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences